TITLE: Perplexity Open-Sources SPACE, Its Production Agent Sandbox DATE: 2026-10-22 COMPANY: Perplexity TOPIC: AI Infrastructure SUMMARY: Perplexity released SPACE, the microVM sandbox platform powering its Computer agent, as open-source under the Apache 2.0 licence on 15 October 2026. The platform isolates every agent task inside its own Firecracker virtual machine, destroys the VM on completion, and has handled millions of sandbox creations per day since entering production. CoreWeave, Akamai, and Crusoe will offer SPACE to their enterprise customers. WHAT CHANGED: Perplexity published the SPACE source code to GitHub on 15 October 2026 under the Apache 2.0 licence, making the microVM platform behind its Computer agent available for anyone to inspect, fork, or deploy. The release came with hosted documentation and a public explanation of the architecture from the engineering team. SPACE uses Firecracker, an open-source virtualisation technology originally built by AWS to power Lambda functions. Every agent task gets a fresh VM at creation and the VM is destroyed when the work ends, preventing one session's credentials or outputs from reaching another. Network access is controlled by the host, and credentials sit outside the sandbox entirely, so an agent that is compromised in one session cannot reach the authentication tokens needed to touch external services. The platform entered production in mid-2026 and has handled millions of sandbox creations per day, powering all Computer sessions since July. Perplexity says median sandbox creation time has dropped to approximately 60 milliseconds, compared to 185 milliseconds under the previous architecture. Sessions can be paused and resumed via rolling snapshots kept for up to one week, and a single session can be branched into multiple parallel sandboxes. Perplexity also announced that CoreWeave, Akamai, and Crusoe have agreed to offer SPACE to their enterprise customers. The company says it will offer SPACE as a paid API product, giving organisations an option to use the managed service rather than self-hosting. An E2B-compatible HTTP API is included in the release. WHY IT MATTERS: The isolation problem has been the blocker for enterprise agent adoption. Most organisations that have evaluated AI agents in the past 18 months have hit the same wall: the agent needs access to real systems, real data, and real credentials. Without a credible isolation architecture, giving an agent those permissions creates unacceptable risk. SPACE is the first open-source production system that demonstrates a viable answer at scale. Open-sourcing the security layer is a credibility move. A vendor claiming their sandbox is secure is different from a vendor whose sandbox architecture has been public and scrutinised for months. Perplexity's decision to release the code means security teams can audit the isolation model rather than accept it on trust. That matters particularly for regulated industries where vendor assurance letters are rarely sufficient. The credential design pattern matters beyond Perplexity. The decision to hold credentials outside the sandbox, with the host controlling access, is an architectural choice other teams building agent infrastructure can adopt directly. SPACE does not teach a new concept, but it provides a production-tested reference implementation of a concept most teams are still figuring out from first principles. CoreWeave, Akamai, and Crusoe as distribution partners signals where enterprise agent compute is heading. These are infrastructure companies with existing relationships with regulated-industry customers. Their decision to offer SPACE suggests they are seeing demand for managed agent sandboxing from customers who need it as a cloud service rather than a self-managed deployment. The session snapshot feature solves a real workflow problem. Most agent frameworks assume a task runs to completion uninterrupted. Regulated workflows rarely can. An agent processing a loan application may need to pause for a compliance review before executing a downstream step. SPACE's pause-resume architecture makes that pattern technically viable in a way that most current agent platforms cannot match. The gap in confidential computing is worth noting. SPACE does not yet use hardware-backed confidential computing, which means the host can in theory see inside the VM. For organisations handling particularly sensitive data, that gap is relevant. Perplexity acknowledges it as a known limitation. DAVID & GOLIATH ANALYSIS: The agent security conversation in most organisations is happening at the wrong level. Teams are debating which model to use, which framework to build on, and which APIs to connect. The isolation layer, the part that determines whether one agent session can leak credentials into another or escape into the host environment, is usually an afterthought or a vendor promise. SPACE changes that, not because it is the only microVM platform ever built, but because it is the first one released by a company running it at production scale for a consumer-visible product. The 108 escape attempts, the four network restriction bypasses, the fixed and retested architecture: that is not a lab exercise. That is a real adversarial test on a system running millions of sessions a day. The fact that it is now public means other teams building agent infrastructure have something concrete to learn from rather than rebuilding the same hard lessons themselves. For operators running lean teams with Claude, the practical implication is this: when you evaluate agent vendors, start asking about the sandbox architecture. Specifically, ask where credentials are stored relative to the agent execution environment, what happens to the VM after a task completes, and whether sessions can be paused for human review. Those questions now have a clear reference answer from a system you can inspect on GitHub. RELEVANT SYSTEMS: Organisational Intelligence System, AI Growth Engine SOURCE URL: https://davidandgoliath.ai/daily-ai-briefing/perplexity-space-open-source-agent-sandbox FEED URL: https://davidandgoliath.ai/daily-ai-briefing/feed --- Published by David & Goliath | https://davidandgoliath.ai Daily AI Briefing: one AI development per day, decoded for business operators. This is a structured companion file optimised for LLM retrieval and citation.